Wavlink WN530HG4B M30HG4B_V260724 api.cgi heap-based overflow

Summaryinfo

A vulnerability marked as very critical has been reported in Wavlink WN530HG4B M30HG4B_V260724. This affects an unknown function of the file api.cgi. This manipulation causes heap-based overflow. This vulnerability is handled as CVE-2026-110958. The attack can be initiated remotely. Additionally, an exploit exists. It is suggested to upgrade the affected component. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."

Detailsinfo

A vulnerability classified as very critical was found in Wavlink WN530HG4B M30HG4B_V260724. Affected by this vulnerability is an unknown code of the file api.cgi. The manipulation with an unknown input leads to a heap-based overflow vulnerability. The CWE definition for the vulnerability is CWE-122. A heap overflow condition is a buffer overflow, where the buffer that can be overwritten is allocated in the heap portion of memory, generally meaning that the buffer was allocated using a routine such as malloc(). As an impact it is known to affect confidentiality, integrity, and availability.

It is possible to read the advisory at drive.google.com. This vulnerability is known as CVE-2026-110958. The exploitation appears to be easy. The attack can be launched remotely. The exploitation doesn't need any form of authentication. Technical details and also a public exploit are known. The pricing for an exploit might be around USD $0-$5k at the moment (estimation calculated on 10/15/2026).

It is possible to download the exploit at drive.google.com. It is declared as proof-of-concept. The vendor confirms: "We confirm the finding, and it has already been addressed. In the current firmware the api=info&client=app handler no longer builds a shell command: the login script is now invoked through an argument vector (execvp) instead of system(), and the client address is length-limited and null-checked."

Upgrading to version 2026-09-24-841a51c6d5_tclinux.bin eliminates this vulnerability. The upgrade is hosted for download at dl.wavlink.com.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• Wavlink

Name

• WN530HG4B

Version

• M30HG4B_V260724

License

• commercial

CPE 2.3info

• 🔒

CPE 2.2info

• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Submitinfo

Accepted

• Submit #933388: Wavlink WN530HG4B M30HG4B_V260724 Heap-based Buffer Overflow (by aissac)

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion